ClawHub
Back to skill

Security audit

zoodata

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ZooData API reference/client that uses a user-provided API key for live paid data lookups, with optional local key storage clearly described.

Install only if you intend to let the agent call ZooData with your API key and spend account credits. Prefer the environment variable for short sessions, keep any ~/.zoodata/config.json file private, and ask the agent to estimate/confirm cost before broad composite scans.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises no declared permissions while its content clearly depends on environment secrets, local file access, shell execution, and outbound network access. This is dangerous because it hides the real trust boundary from users and policy systems, making secret use and external calls less visible and less governable.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The description presents the skill as a passive API reference, but the body instructs live API invocation, credential checks, raw review retrieval, and multi-step analytical workflows that consume credits. This mismatch can mislead users into granting trust to what appears to be documentation while actually enabling active operations against an external service with a bearer token.

Description-Behavior Mismatch

High
Confidence
91% confidence
Finding
The declared skill purpose is API reference/documentation lookup, but the code exposes a broad executable CLI for market research, competitor analysis, review analysis, and multi-step workflows that make live API calls and consume credentials. This capability mismatch is dangerous because agents or users may invoke powerful operational behavior under the assumption that the skill is only informational, expanding data access and external action beyond the advertised trust boundary.

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
The file implements extensive composite workflows that automatically perform many external requests, aggregate results, and drive competitive-analysis operations unrelated to a simple endpoint-reference skill. In this context, hidden analytical execution is risky because it can trigger unintended API usage, credit consumption, and broader data processing than a caller expects from a documentation helper.

Session Persistence

Medium
Category
Rogue Agent
Content
- **Get a free key** (1,000 credits, no credit card): https://zoodata.ai/en/api-keys
   - **Configure** via one of:
     - `export ZOODATA_API_KEY='hms_live_xxx'` (session only)
     - `mkdir -p ~/.zoodata && chmod 700 ~/.zoodata && (umask 077; echo '{"api_key":"hms_live_xxx"}' > ~/.zoodata/config.json)` (persistent; keep the file private — 0600)
4. **Optionally** state in **one sentence** what the workflow will produce once the key is configured (deliverable shape only — no numbers, no market color, no "common sense" preview).

## On 401 Invalid Key
Confidence
83% confidence
Finding
The skill instructs users to persist the API key in ~/.zoodata/config.json, creating long-lived credential material on disk. While common, session persistence increases the blast radius of local compromise, accidental backup/sync leakage, or later unintended reuse by other tools reading that path.

Static analysis

No suspicious patterns detected.